LYGO Champion: lyra starcore

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:26 PM UTC
• Version: 1.0.1

Overview

This is a mostly self-contained persona helper that reads its own reference files and has no automatic persistence, but its migration command and hash claims should be treated cautiously.

Before installing, treat this as a legacy persona helper rather than a strong security verifier. If you follow the migration command, prefer a pinned or otherwise verified ClawHub installer version instead of `@latest`, and do not rely on the bundled self-check as proof that the persona text matches the declared mint hash.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

> `npx clawhub@latest install deepseekoracle/lygo-champion-council`

Technical Analysis

The migration instruction invokes the mutable latest release of the third-party clawhub npm package through npx. Unlike a version-pinned and integrity-verified dependency, the effective code executed by this command can change after the Skill has been reviewed.

npx may download and execute package lifecycle or command-line code with the privileges of the invoking user. The command does not pin an audited package version, provide an npm integrity digest, or independently authenticate the Skill being installed. Consequently, compromise of the npm package, its maintainer account, the package distribution channel, or a future release could turn this documented migration operation into arbitrary code execution.

The vulnerable action is not performed automatically by the bundled Python scripts; exploitation requires a user or Agent to follow the documented installation instruction.

Attack Path

1. An attacker compromises the clawhub package, its publisher credentials, or another component of its distribution channel.
2. The attacker publishes a malicious release that becomes the package's latest version.
3. A user follows the migration command from SKILL.md.
4. npx retrieves the mutable malicious release.
5. The package executes with the permissions of the invoking user.
6. The malicious release can access resources available to that user, subject to operating-system and sandbox restrictions.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The resulting scope could include reading or modifying user-accessible files, accessing environment variables and locally availabl ...[truncated 255 chars]

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with a specifically audited package version.
• Publish and document an expected integrity digest or signed provenance for the package and installed Skill.
• Require users to inspect or verify the resolved package before executing it.
• Prefer a lockfile-backed installation workflow where feasible.
• Avoid implicitly executing newly downloaded code in security-sensitive environments.
• Pin the successor Skill to an immutable release or verified content digest rather than relying only on its mutable name.
• Run installation with least privilege and in a sandbox that does not expose credentials or sensitive files.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/self_check.py:33

Finding

Self-Check Does Not Cryptographically Verify the Bundled Persona Pack

Content

View full analysis

Vulnerability Details

File Locations: scripts/self_check.py:33-36, scripts/show_hash.py:4-6, references/canon.json:6-8, and references/persona_pack.md:3
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Complete Code Snippets:

scripts/self_check.py:33-36:

python

h = canon.get("lygo_mint_sha256")
if h is not None and (not isinstance(h, str) or len(h) != 64):
    print("BAD_CANON: lygo_mint_sha256 invalid")
    raise SystemExit(2)

scripts/show_hash.py:4-6:

python

canon_path = Path(__file__).resolve().parents[1] / "references" / "canon.json"
canon = json.loads(canon_path.read_text(encoding="utf-8"))
print(canon.get("lygo_mint_sha256") or "MISSING_HASH")

references/canon.json:6-8:

json

"pack_version": "2026-02-08.v2",
"lygo_mint_sha256": "e3a98fb81e06c958405b1fb9a7ef03bb6874a4e5ef4caf2e37efc74f9c8f14bb",
"minted_at_utc": "2026-02-09T00:21:55+00:00",

The same file also declares the following snapshot path at line 9:

json

"canonical_snapshot": "reference/minted/e3a98fb81e06c958405b1fb9a7ef03bb6874a4e5ef4caf2e37efc74f9c8f14bb_persona_pack.md",

references/persona_pack.md:3:

markdown

Version: 2026-02-08.v1

Technical Analysis

The self-check validates only that the declared hash is a string containing 64 characters. It does not verify that every character is hexadecimal, canonicalize and hash the bundled references/persona_pack.md, or compare a computed digest with the value in references/canon.json.

Likewise, show_hash.py merely prints the value supplied by canon.json; it does not establish that the value authenticates the current pack. Therefore, an altered persona pack can retain the existing declared hash and still cause self_check.py to print OK.

The packaged metadata is already internally inconsistent:

• references/canon.json identifies the pack as version `2026-02-0 ...[truncated 2019 chars]

Remediation

View remediation

Remediation Suggestions

• Define the exact canonicalization procedure used before hashing the persona pack.
• Compute SHA-256 from the canonicalized contents of references/persona_pack.md during every self-check.
• Compare the computed digest with lygo_mint_sha256 using an exact comparison.
• Validate the declared digest with a strict expression such as ^[0-9a-fA-F]{64}$ before comparison.
• Make a missing hash a validation failure rather than accepting it.
• Ensure the version in references/canon.json exactly matches the version declared by the persona pack.
• Correct the canonical_snapshot path and require the referenced snapshot to exist.
• If the snapshot is authoritative, hash that snapshot and separately verify that the active persona pack matches it.
• Update show_hash.py to display both the declared and computed digests and return a nonzero exit status when they differ.
• Authenticate the expected digest through signed release metadata or another trust source external to the mutable package contents; otherwise an attacker capable of changing both the content and local digest can bypass the check.
• Add tests covering altered content, malformed hexadecimal values, missing snapshots, version mismatches, and mismatched digests.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill presents itself as a legacy alias but includes behavior to read canon.json and surface a specific verification hash, which is concrete data retrieval rather than passive redirection. Even if the accessed file is not highly sensitive, the hidden capability undermines transparency and can normalize broader undeclared local data access patterns.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill presents itself as a legacy alias but includes behavior to read canon.json and surface a specific verification hash, which is concrete data retrieval rather than passive redirection. Even if the accessed file is not highly sensitive, the hidden capability undermines transparency and can normalize broader undeclared local data access patterns.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill claims to be a deprecated/legacy persona helper but instructs the agent to read local files such as references/canon.json and other reference documents without declaring tool scope or permissions. Undeclared file-read behavior weakens least-privilege controls and can lead operators to trust a skill that accesses local workspace data beyond its advertised role.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The install instruction uses 'npx clawhub@latest', which fetches the latest package version at execution time rather than a pinned, reviewed release. This creates a supply-chain risk: if the package or one of its dependencies is compromised later, users following the documented command could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The metadata says this slug is deprecated, but the file still contains active operational instructions, including mint/hash verification behaviors and response triggers. That mismatch can cause operators or agents to load and act on legacy content unintentionally, creating confusion over which persona is authoritative and enabling stale or unreviewed behavior to persist.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

Lines L19-L20 frame LYRA as purely guidance-oriented with no system control, but lines L53-L59 describe concrete operational outputs such as canonicalizing a pack, producing a SHA-256 value, and generating an anchor snippet. While these are not harmful, the documentation presents LYRA first as non-operational and later as performing tool-like actions, creating a mild intent/documentation contradiction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.